Traverse the export table (class code)

//01 times Calendar Export table. CPP: The entry point that defines the console application. //#include"stdafx.h"#include"windows.h"//************************************//Method:ispefile//Fullname:ispefile//Access:public//Returns:bool failed successfully//Qualifier://Parameter:tchar * szpath path//************************************BOOLIspefile (tchar*szpath) {BOOL bsuccess=TRUE; //1 reading the PE file to memoryHANDLE hfile =CreateFile (szpath, Generic_read, File_share_read| File_share_write |file_share_delete, NULL, open_existing, file_attribute_normal, NULL); DWORD dwsize=GetFileSize (hfile, NULL); DWORD Dwrubbish=0; unsignedChar* PBuf =NewUnsignedChar[dwsize]; ReadFile (hfile, PBuf, dwsize,&dwrubbish, NULL); //2 Determine if it is a PE filePimage_dos_header PDos =(Pimage_dos_header) PBuf; if(Pdos->e_magic! =image_dos_signature) {bsuccess=FALSE; GotoError; } pimage_nt_headers pNt= (pimage_nt_headers) (PBuf + pdos->e_lfanew); if(Pnt->signature! =image_nt_signature) {bsuccess=FALSE; GotoError; }error:if(PBuf! =NULL) {        Delete[]pbuf; }    if(hfile! =Invalid_handle_value)    {CloseHandle (hfile); }    returnbsuccess;}//************************************//Method:rvatooffect//Fullname:rvatooffect//Access:public//Returns:dword//Qualifier: Converting RVA to Offect//RVA to be converted by Parameter:dword RVA//parameter:unsigned char * pFile The buffer that stores the contents of the PE file//************************************DWORD Rvatooffect (DWORD RVA, unsignedChar*pFile) {    //1 NT header foundPimage_dos_header PDos =(Pimage_dos_header) pFile; Pimage_nt_headers pNt= (pimage_nt_headers) (PFile + pdos->e_lfanew); //2 Data Catalog table foundPimage_section_header psection =image_first_section (pNt); //3 determine if the position to be converted is not a PE head    if(RVA < psection->virtualaddress) {        returnRVA; }    //4 traversing in a Data Catalog table for calculation     for(inti =0; I < pnt->fileheader.numberofsections; i++)    {        if(RVA>= psection->virtualaddress) &&(RVA<= psection->virtualaddress + psection->misc.virtualsize)) {returnRva-psection->virtualaddress + psection->Pointertorawdata; } psection++; }    return-1;}int_tmain (intARGC, _tchar*argv[]) {    //1 reading the PE file to memoryHANDLE hfile =CreateFile (L"D:\\user32.dll", Generic_read, File_share_read| File_share_write |file_share_delete, NULL, open_existing, file_attribute_normal, NULL); DWORD dwsize=GetFileSize (hfile, NULL); DWORD Dwrubbish=0; unsignedChar* PBuf =NewUnsignedChar[dwsize]; ReadFile (hfile, PBuf, dwsize,&dwrubbish, NULL); //2 dos header foundPimage_dos_header PDos =Pimage_dos_header (PBUF); //3 NT header foundPimage_nt_headers pNt = pimage_nt_headers (PBuf + pdos->e_lfanew); //4 extension headers foundPimage_optional_header poption = & (pnt->Optionalheader); //5 Data Catalog table foundPimage_data_directory pdatadirectory = poption->DataDirectory; //6 Find the Data directory of the exported tablePimage_data_directory pexportdirectory = (pdatadirectory +0); //7 parsing the data directory of the exported table//7.1 Getting the file offset of the exported tableDWORD dwexoffect = Rvatooffect (pexportdirectory->virtualaddress, PBuf); //7.2 Get the exported table structure bodyPimage_export_directory Pexport = (pimage_export_directory) (PBuf +dwexoffect); //7.3 Print DLL's name, note: It is not possible to print directly, it provides only the RVA offset of a name    Char* PName = (Char*) (Rvatooffect (Pexport->name, PBuf) +PBuf); printf ("%s\n", PName); //8 Preparing to parse the export table//8.1 Number of functionsDWORD Dwnumoffun = pexport->numberoffunctions; //8.2 Number of namesDWORD Dwnumofname = pexport->Numberofnames; //8.3 location of the function Address tablePdword Poffectoffun =( Pdword) (Rvatooffect (Pexport->addressoffunctions, PBuf) +PBuf); //8.4 Position of the Sequence number tablePword Porder =( Pword) (Rvatooffect (Pexport->addressofnameordinals, PBuf) +PBuf); //8.5 Position of the name tablePdword Poffectofname =( Pdword) (Rvatooffect (Pexport-&GT;ADDRESSOFNAMES,PBUF) +PBuf); //8.6 Ordinal cardinalityWORD wbase = pexport->Base; //9 Start parse export table     for(inti =0; I < dwnumoffun;i++){        //9.1 If this is an invalid address        if(Poffectoffun[i] = =0)            Continue; //9.2 is not an invalid address, go to the ordinal table to find this ordinal number        intj =0;  for(; J < Dwnumofname; J + +){            if(Porder[j] = =i) {                //9.2.1 found the serial number, indicating that the function has a name, which belongs to the name export                Char* Pnameoffun = (Char*) (Rvatooffect (Poffectofname[j], PBuf) +PBuf); printf ("The function ordinal is: The%HX function address is: The%x function is named:%s\n", Wbase+I, Poffectoffun[i], pnameoffun);  Break; }        }        if(J = =dwnumofname) {            //9.2.2 If the serial number is not found, it means that the function has no name, only the ordinal number,//belongs to the ordinal export, this sequence number is called the imaginary sequence numberprintf"The function ordinal is: The%HX function address is: The%x function is named: null\n", Wbase+I, poffectoffun[i]); }    }    return 0;}

Traverse the export table (class code)